ACE Communication & Documentation 2 — Questions and Answers
Question 1: When writing a forensic report, which section should describe the investigator's methodology and tools used during examination?
- Executive Summary
- Findings Section
- Examination Methodology (Correct answer)
- Chain of Custody Log
Correct answer: Examination Methodology
The Examination Methodology section documents the specific tools, versions, and procedures used during the forensic examination.
Question 2: An expert witness is asked a question outside their area of expertise during testimony. The proper response is to:
- Answer based on general knowledge
- Refuse to answer and explain the limitation (Correct answer)
- Defer to opposing counsel
- Speculate based on available evidence
Correct answer: Refuse to answer and explain the limitation
An expert witness must only testify within their established area of expertise and should clearly state when a question falls outside that scope.
Question 3: Which document format is most appropriate for providing a high-level summary of forensic findings to non-technical executives?
- Technical Appendix
- Executive Summary (Correct answer)
- Chain of Custody Form
- Hex Dump Report
Correct answer: Executive Summary
An executive summary presents findings in non-technical language suitable for decision-makers who do not need granular technical details.
Question 4: In FTK, the 'Case Log' feature is primarily used to:
- Hash verification of evidence
- Record automated actions taken during the case (Correct answer)
- Generate MD5 reports
- Export bookmarked files
Correct answer: Record automated actions taken during the case
FTK's Case Log automatically records actions, searches, and events that occur within the case for documentation and audit purposes.
Question 5: When documenting a forensic image acquisition, which detail is LEAST critical to record?
- Hash values of the source and destination
- Date and time of acquisition
- Investigator's personal opinion of the suspect (Correct answer)
- Write blocker make and model used
Correct answer: Investigator's personal opinion of the suspect
Personal opinions about suspects are inappropriate and irrelevant in forensic documentation; only objective, verifiable facts should be recorded.
Question 6: A forensic examiner discovers evidence of a crime unrelated to the original investigation scope. Proper documentation practice requires:
- Ignoring it to stay within scope
- Documenting and reporting the new finding to the attorney or agency (Correct answer)
- Deleting the unrelated evidence
- Continuing without noting the discovery
Correct answer: Documenting and reporting the new finding to the attorney or agency
Examiners must document and report all discovered evidence, even if outside the original scope, so legal counsel can determine the appropriate course of action.
Question 7: When preparing a forensic report for use in civil litigation, the tone and language should be:
- Accusatory and conclusive
- Objective, factual, and free of speculation (Correct answer)
- Written for a technical audience only
- Informal to make it accessible
Correct answer: Objective, factual, and free of speculation
Forensic reports in any legal context must be objective and factual, avoiding speculation or bias that could undermine the examiner's credibility.
ACE Communication & Documentation 2
When writing a forensic report, which section should describe the investigator's methodology and tools used during examination?